Attack surface
The sum of all the points where an attacker could potentially get into a system — open ports, API endpoints, login pages, dependencies, employees. Reducing the attack surface ("attack surface reduction") is a fundamental security principle: the less is exposed, the harder it is to attack.
What's included: network services and open ports, web interfaces and APIs, authentication points, third-party dependencies (a vulnerability in a library is your attack surface), cloud resources, and even people (phishing targets). The principle: any feature, service, or access you DON'T need but expose anyway is an unnecessary risk → turn it off, remove it, restrict it. Concretely: close unused ports, remove unnecessary features/packages, restrict who can reach what (network segmentation, least privilege), and reduce the code's dependencies. Attack Surface Management (ASM) is the discipline of continuously mapping and monitoring your externally exposed surface (often larger than you think — forgotten servers, shadow IT). Tightly tied to defense in depth and least privilege. A central mental framework in hardening. Related to kill chain and threat model.